Multiplicative vs Additive Homomorphic ElGamal

A homomorphism is a structure preserving map between two algebraic structures. Let’s consider a simple function from the integers to themselves (endomorphism):

f : ℤ → ℤ, f(x) = x + x

This function simply doubles its argument. It preserves group structure, in this case addition, because the following is satisfied

f(a) + f(b) = f(a + b)

Applying + at the range of the function gives us the same as mapping after we apply + at its domain, for example:

f(1) + f(2) = 2 + 4 = 6 = f(1 + 2)

To make explicit what structure is being preserved this notation is available

f : (ℤ, +)→(ℤ, +)

the preserved structure in the domain and range is addition.

Encryption

Homomorphic encryption is simply encryption that is homomorphic. If we denote our encryption function with E, the function E must satisfy

E(a) ⊕ E(b) = E(a ⊗ b)

for some choice of operators ⊕ and ⊗. With our previous notation:

E : (X, ⊗)→(Y, ⊕)

where X and Y are the algebraic structures the encryption function operates on. ElGamal encryption is a case of homomorphic encryption. Consider ElGamal when used with a safe prime modulus, p = 2q + 1 (this is necessary for semantic security), as described by:

E : Gq → Gq x Gq

where Gq is a subgroup order q of (ℤp)*, the multiplicative group of integers modulo p. The function E for ElGamal is specified as:

Let

x: secret key

h: public key

g: generator

m: message

r: randomness

Then

E(m) = (gr, m · hr)

The pair of values on the right corresponds to the product space Gq x Gq above, ie a pair of two values each in Gq. ElGamal as defined is multiplicatively homomorphic:

E : (Gq, •)→(Gq x Gq, •)

where • denotes multiplication. This means that:

E(m1) · E(m2) = E(m1 · m2)

Let’s check:

which shows that ElGamal encryption is in fact homomorphic with respect to multiplication. We can see this in action using the unicrypt library by the E-Voting Group at the Bern University of Applied Sciences. The following code[1] encrypts the values ‘4’ and ‘5’, then multiplies them together in the ciphertext space. After that, it calculates 4·5 in the plaintext space and then encrypts the result. Both values are compared, and should match by the homomorphic property.

The multiplicative homorphic property of standard ElGamal is used, for example, in voting protocols that employ a re-encryption mixnet. In such a scheme each mixing authority permutes and re-encrypts votes handling them as input to the next authority. The re-encryption of each vote is necessary, otherwise a simple permutation would allow identifying votes by matching ciphertexts. This re-encryption step corresponds to this operation

E(1) · E(m)

which multiplies, in the ciphertext space, the original vote by 1. This allows changing the ciphertext without changing the vote it represents

E(1) · E(m) = E(1 · m) = E(m)

And the vote is unchanged, by the multiplicative homomorphic property.

Additively Homomorphic ElGamal

We just saw how we can do multiplication operations in the ciphertext space when using ElGamal encryption. It turns out that with a small change you can support addition instead of multiplication. In this case we have

E : Zq → Gq x Gq

and as before:

Let

x: secret key

h: public key

g: generator

m: message

r: randomness

But now, we have a different function

E(m) = (gr, gm · hr)

as opposed to standard ElGamal, our previous case, where we had

E(m) = (gr, m · hr)

When encrypting a message m, we are now first transforming it into gm and then we proceed as before. In other words, the scheme is the same as before except the message takes the form gm instead of m. This alternate scheme, sometimes called exponential ElGamal, is additively homomorphic:

Note that exponential ElGamal has Zq as its message space. Before encryption the message is encoded as gm. After encryption, gm has to be decoded to yield m. This step is missing in the output above, which is why we see 262144 (which is 49).

But wait a minute, isn’t this last step taking a discrete logarithm which is exactly what is supposed to be infeasible for the scheme to be safe? That is correct, which is why exponential ElGamal can only be practically used when the values to be decrypted are expected to be small, and a look up table can be used to do the final conversion. In fact, the code above mimics this process, as it is calculating the modular exponentiation gm and then comparing it to the output of decryption, so the original message is extracted as the value 9.

Additively homomorphic ElGamal is useful in voting schemes that carry out the tally by virtue of applying the + operation in the ciphertext space, thus avoiding the need to decrypt individual votes. In such a scheme, only the final ciphertext obtained by applying the sum operation is decrypted by the authorities. This final value corresponds to the election result. Such schemes are referred to in the literature as “based on homomorphic encryption”, although as we saw before re-encryption mixnets also employ this property (multiplicatively). One well known example of such a scheme is detailed in Cramer, Gennaro, Schoenmakers: A Secure and Optimally Efficient Multi-Authority Election Scheme.

which should sound familiar.

Fully Homomorphic Encryption

We have seen how standard ElGamal encryption is multiplicatively homomorphic, and how a small change can make it additive. These properties allow computing in the ciphertext space, maintaining privacy.

Above we have computed using multiplication or addition, but not both at the same time. An encryption scheme that allows both operations simultaneously is said to be fully homomorphic. The combination of addition and multiplication allows arbitrary functions to be computed on encrypted data. Fully homomorphic encryption is an active area of research. Although currently experimental[2], a successful scheme would have very important privacy implications, opening the door for all sorts of cloud services that perform arbitrary operations on user data while maintaining privacy.

Notes

[1] We have not bothered with encoding messages from the ring Zq into Gq since the numbers we are using are quadratic residues.